Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

boot.initrd.clevis.devices.<name> relies on fileSystems.<name>.device which not used by a system deployed with disko #927

Open
elias-online opened this issue Dec 27, 2024 · 2 comments

Comments

@elias-online
Copy link

When using disko to deploy systems, fileSystems.<name> = { }. is not used which prevents setting boot.initrd.clevis.devices.<name> = { } and therefore the use of Clevis entirely.

Clevis enables root filesystem decryption on a remote host. Example NixOS implementation here:
https://camillemondon.com/talks/fosdem24-clevis/#/the-nixos-implementation

Is this something that can be worked around somehow or would the boot.initrd.clevis need to have another way of defining devices?

@elias-online
Copy link
Author

To clarify a little on the reproduction steps on this:

  1. Deploy a system with disko
  2. Add the following to your configuration:
boot.initrd.clevis.enable = true;
boot.initrd.clevis.devices."/dev/sdX".secretFile = "/secret.jwe";
  1. Running nixos-rebuildresults in:
error:
       Failed assertions:
       - No filesystem or LUKS device with the name /dev/sdX is declared in your configuration.

@Enzime
Copy link
Member

Enzime commented Dec 28, 2024

Do you have mountpoint set? Whether or not fileSystems gets set is based on whether or not mountpoint is set:

default = lib.optional (config.mountpoint != null) {
fileSystems.${config.mountpoint} = {
device = config.device;
fsType = config.format;
options = config.mountOptions;
};
};

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants